CVE-2025-30081 json
Clickstorm SEO Allows Cross-Site Scripting (XSS)
published 2025-03-19 19 mo ago modified 2025-03-19 19 mo ago also GHSA-vmgw-24w6-9v82
- cvss
- 6.3
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no EPSS score yet
- public exploits
- 0
- none known
Summary
A cross-site scripting (XSS) vulnerability has been discovered in the Clickstorm SEO extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Updates 6.7.0, 7.4.0, 8.3.0 and 9.2.0 are available for download.
Patch / fix
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | clickstorm/cs-seo | >=9.0.0, <9.2.0 >=8.0.0, <8.3.0 >=7.0.0, <7.4.0 >=6.0.0, <6.7.0 |
9.2.0 8.3.0 7.4.0 6.7.0 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
Sources
- GitHub Advisory GHSA-vmgw-24w6-9v82
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.